Skip to content

Least Privilege

What is Least Privilege?

The security principle of granting users only the minimum access rights needed to perform their job functions. Reduces the attack surface and limits damage from compromised accounts.

Information Security

Related terms

Access ControlRBAC (Role-Based Access Control)Zero Trust

Frameworks that govern least privilege

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on least privilege

Requirements naming least privilege across 6 standards, quoted from the control text.

AWS Well-Architected Security Pillar5 controls

Author IAM policies that grant only the specific actions, resources and conditions required, refining policies from broad starting points using Access Analyzer policy generation.

SEC03-BP02 · Grant least privilege access →
NIST SP 800-171 Rev 33 controls

Prevent non-privileged users from executing privileged functions; log execution of privileged functions.

03.01.07 · Least Privilege - Privileged Functions →
NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI)3 controls

Determines whether privileged accounts are restricted to named personnel with an authorized need and are separated from those users' ordinary accounts.

171A-03.01.06 · Least Privilege - Privileged Accounts →
PCI DSS 4.03 controls

Access is assigned to users, including privileged users, based on: • Job classification and function. • Least privileges necessary to perform job responsibilities

7.2.2 · Access is assigned to users, including privileged users, based on: • Job classification and function. • Least privileges necessary to perform job responsibilities →
BSI IT-Grundschutz2 controls

Access enforcement and least privilege. Control from BSI IT-Grundschutz framework, domain: BSI IT-Grundschutz: Access Control & Identity.

BSI-02 · Access enforcement and least privilege →
NIST SP 800-1712 controls

Apply least privilege and separation of duties to user accounts, administrative roles, and system processes that act on controlled unclassified information.

171-AC-2 · Least Privilege and Separation of Duties →

Questions people ask about least privilege

What is Least Privilege?
The security principle of granting users only the minimum access rights needed to perform their job functions. Reduces the attack surface and limits damage from compromised accounts.
Why is Least Privilege important for compliance?
Least Privilege is a key concept in Information Security. Understanding least privilege helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
What concepts are related to Least Privilege?
Key concepts related to Least Privilege include Access Control, RBAC (Role-Based Access Control), Zero Trust. Understanding these interconnected concepts provides a more comprehensive view of Information Security requirements and helps organizations build holistic compliance programs.
Which compliance frameworks address Least Privilege?
Least Privilege appears in the requirement text of AWS Well-Architected Security Pillar, NIST SP 800-171 Rev 3, NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI), PCI DSS 4.0, BSI IT-Grundschutz. Across these standards we have identified 18 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Least Privilege?
Explore our compliance framework pages to see how least privilege applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Least Privilege applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.